What happened
AWS published a security bulletin and NVD listed CVE-2026-18394 (CVSS 7.4, High) on 2026-07-31, describing how prompt injection can manipulate an agent into routing HTTP requests through attacker-controlled proxies, leaking configured credentials.
Why it matters
This is a direct demonstration of prompt injection escalating to credential theft in a production-grade agent SDK backed by AWS — showing that tool-level credential configuration in agent frameworks needs the same scrutiny as any other secret-handling code path, since the LLM itself is an attacker-influenceable decision point.
Attack vector
Incorrect authorization in the http_request tool allows a remote attacker — via prompt injection influencing the LLM's tool-calling decisions — to redirect outbound requests through actor-controlled proxy infrastructure, causing credentials configured via HTTP_REQUEST_TOKEN_CONFIG to be sent to the attacker's proxy and exfiltrated.
Affected systems
Strands Agents Tools (strands-agents-tools) before 0.8.2
Mitigation
Upgrade to strands-agents-tools 0.8.2+; see AWS Security Bulletin 2026-069-aws for remediation guidance.